hhimanshu-jha/git-history-secret-scanv0.8.0Public
Git history secret scan
Finds credentials that live in git history, not just the working tree.
Read the full description
Deleting a .env and committing does not remove it: every blob ever committed stays reachable, and a hackathon repo is usually made public at submission time. Three independent stages run as parallel DAG steps (history blob scan across every ref, env files that were ever committed, and and whether the repository it is pushed to is actually public, asked of your own gh session rather than assumed from the host), then one join weighs each finding against that exposure. A stage that cannot complete becomes a labeled indeterminate rather than a silent pass, and every report states how many objects it actually walked, because a partial scan and a clean repository must not read the same. Read-only: never rewrites history, never mutates the repository. It makes no network call of its own: the one optional lookup shells out to your existing gh login, and when gh is missing or logged out the report says the visibility was not resolved and why, rathe
Before you run it3 local tools
Everything here is checked on your machine when rote inspects the play. This page never learns what you have installed or which credentials you hold.
- ○python3local tool
Requires >=3.8. Run rote play inspect to check your host; unverified versions remain unknown.
- ○gitlocal tool
Must be on your PATH when used. minimum version undeclared.
- ○ghlocal tooloptional
Must be on your PATH when used. minimum version undeclared.
Inputs2, all optional
rote asks for these before running and shows the defaults it will use.
- Repo
repoAbsolute path to the repository to scan. Leave it out and the most recently committed repository found under your usual project directories is scanned instead, with the report naming which one it chose. A relative path is never right here: steps run in the play run workspace, not your shell.
optionalstringexample/Users/me/src/my-entrycustom value allowed - Budget
budgetMaximum history objects to walk. A scan that hits this limit says so in its report rather than reporting a clean result it did not earn. Raise it for a large repository.
optionalstringdefault20000example20000custom value allowed
What it changes
No write operations are declared in this version's manifest.
Credentials remain in the recipient's local rote vault; this page and the publisher never receive them.
Runtime details
- rote CLIversion 0.62.0 or newer
- Servicesnone declared
- Digest
sha256:55c58d79f1782de9e8d427c2907def3054658c1c155521c902babc3da00b0371 - Archive size15618 bytes
- Published2026-09-03T10:00:50.677773+00:00
- Published withrote 0.75.0
Credential values and current readiness remain local. Opening this page never prompts for a credential, opens an authorization browser, or calls a service this play uses.
A play is a published, versioned automation package that runs on your own machine through rote, a free command-line tool. Opening this page installs nothing and runs nothing.